Zero Trust and Secure Networking Standards

Standard Metadata

Area: Security
Owner: Security group
Last reviewed: 2026-09-09
Next review due from: 2026-12-01
Enforcement: Code review
Status: Active

Access to infrastructure must be granted using the principle of least privilege · SEC-02.1 · MUST · DEV

Web applications should utilise a Web Application Firewall (WAF) to protect systems from common attacks · SEC-02.2 · SHOULD · DEV

This should always be presented as an option to clients, with benefits and costs clearly explained.

Cloud-hosted applications should be deployed within an isolated virtual network · SEC-02.3 · SHOULD · DEV

This approach introduces additional cost and complexity, so should be presented as an option to clients for them to understand the pros and cons.